5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45045

CVE-2026-45045: Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45045

CVE-2026-45045:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gofiber/fiber/v3	go	<= 3.2.0	3.3.0
github.com/gofiber/fiber/v2	go	<= 2.52.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how the GoFiber proxy middleware handles the X-Real-IP header. The core issue is the use of Header.Add() instead of Header.Set() in the BalancerForward function, and the lack of any X-Real-IP header setting in the Forward and DomainForward functions. This allows an attacker to send a request with a spoofed X-Real-IP header. Because Add() appends a new header and doesn't replace the existing one, the upstream server receives two X-Real-IP headers and will most likely use the first one, which is the attacker's spoofed IP. This can lead to bypassing IP-based rate limiting, access controls, and incorrect logging. The analysis of the patch commit confirms that the Forward and DomainForward functions were also vulnerable and were fixed by adding Header.Set("X-Real-IP", c.IP()). The vulnerability description confirms that BalancerForward had a similar issue. Therefore, all three functions are identified as vulnerable.

Vulnerable functions

BalancerForward

middleware/proxy/proxy.go

The function uses `Header.Add("X-Real-IP", ...)` which appends the client's IP to the `X-Real-IP` header instead of overwriting it. This allows an attacker to spoof their IP address by providing a `X-Real-IP` header in the request, as the upstream server will likely process the first (attacker-controlled) header.

Forward

middleware/proxy/proxy.go

The function was missing the setting of the `X-Real-IP` header. This allowed an attacker to send a request with a spoofed `X-Real-IP` header, and the upstream server would use the spoofed IP. The patch fixes this by setting the header to the real client IP.

DomainForward

middleware/proxy/proxy.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.